1. CSC 386 – Computer Security Scott Heggen

2. Agenda The Foundations of Computer Security

3. Foundations of Computer Security Define computer security

4. Foundations of Computer Security Classical view of security: Prevention Detection Reaction What’s wrong with this model in the context of computer security?

5. Foundations of Computer Security A more modern view of security: Confidentiality Unlinkability Anonymity Integrity Availability Denial of service Accountability Authentication Logging Non-repudiation Reliability The big 3!

6. The Fundamental Dilemma “Security-unaware users have specific security requirements but usually no security expertise”

7. Data vs. Information What’s the difference?

8. Security-focused Design Decisions Decision 1: In a given application, should the protection mechanisms in a computer system focus on data, operations, or users?

9. Security-focused Design Decisions Decision 2: Where in the computing system should a security mechanism be placed?

10. Man-Machine Scale

11. Security-focused Design Decisions Decision 3: Do you prefer simplicity – and higher assurance – to a feature-rich security environment, or vice versa? What’s the trade-off?

12. Security-focused Design Decisions Decision 4: Who should be tasked with defining and enforcing security? A central entity, or the individual components in the system? What’s the trade-off?

13. Security-focused Design Decisions Decision 5: How can you prevent an attacker from getting access to a layer below the protection mechanism?

14. Next Class Due: Begin Homework 1 (Due Friday, 8/29) Agenda: Identification and Authentication